EUVD-2026-70791

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network...

dns-honeypot

My First 24 Hours Running a DNS Honeypot As an engineer who spends most of my days knee-deep in observability tooling, I get the occasional idea that I just have to run with. This was one of those experiments: spin up a DNS resolver on a clean IP that nobody advertises, then let the internet talk...

EUVD-2026-70852

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulatio...

CVE-2026-85379 light0011 cms Query Builder ChapterController.class.php searchChapter sql injection

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulatio...

CVE-2026-85379

light0011 CMS contains a SQL injection vulnerability in the Query Builder component, specifically in the function ChapterModel::searchChapter within App/Home/Controller/ChapterController.class.php. The flaw is triggered by manipulation of the content argument and can be exploited remotely without...

CVE-2026-75164

CVE-2026-75164 is an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user holding the low-privileged Standard role can retrieve arbitrary files from the device filesystem by manipulating the fil...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

Flextype CMS 1.0.0-alpha.3 Server-Side Request Forgery

lextype CMS version 1.0.0-alpha.3 contains a server-side request forgery SSRF vulnerability in the expression-processing functionality exposed through the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch function, causing the Flextype serve...

CVE-2025-46171

vBulletin 3.x.x - DoS via Buddy List Overload Summary The /misc.php?do=buddylist endpoint runs a single, large JOIN query that retrieves all buddies along with their user and session information to check online status. Because this query processes the entire buddy list without pagination or resul...

CVE-2026-62906

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network...

pySigma

pySigma pySigma 是一个将 Sigma 规则解析并转换为查询的 Python 库。它取代了传统 Sigma 工具链（sigmac），设计更为简洁，且几乎经过了全面测试。将规则转换为查询语言的后端，以及将规则转换到日志数据模型的处理管道，均被拆分到独立项目中，以保持 pySigma 本身精简且与厂商无关。请参阅下方 相关项目 部分以获取概览。 快速开始 要开始使用 pySigma，您需要 Python 3.10 或更高版本。使用您选择的 Python 包管理器进行安装。示例： root@kitploit: pip install pysigma pipenv install...

CVE-2026-54433

CVE-2026-54433: XSS almacenado en correos de texto plano de Roundcube Este repositorio contiene una prueba de concepto configurable en Python para CVE-2026-54433 , una vulnerabilidad de cross-site scripting almacenado en el renderizador de correos de texto plano de Roundcube. Un remitente no...

GHSA-3F6P-5WW8-9RCR vulnerabilities

Vulnerabilities for packages: sqlpad...

EUVD-2026-52277

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write...

Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

AZL-99093 CVE-2026-33630 affecting package fluent-bit 3.1.10-6

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

AZL-99095 CVE-2026-33630 affecting package nodejs 24.18.1-1

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

CVE-2026-33630

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

CVE-2026-33630

c-ares , an asynchronous DNS resolver library, is affected by a use-after-free / double-free in its query-completion handling, present from version 1.32.3 through 1.34.6 and fixed in 1.34.7 . The flaw occurs when a query's callback is invoked while the query is still linked in the channel's inter...